Examkin

Question

Difficulty: MediumVPC Security for Developers

A developer is implementing an AWS Lambda function that performs data enrichment. The function must query an Amazon Aurora MySQL database cluster running in a private VPC subnet. In addition, the function must invoke an external public API to retrieve conversion rates and securely access database credentials. The Lambda function is configured to run within the same private VPC subnet. Which configuration will allow the Lambda function to meet these requirements?

  1. Deploy the Lambda function in the private subnet. Create a NAT Gateway in a public subnet, and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway. Store the database credentials in AWS Secrets Manager, and grant the Lambda execution role permissions to retrieve the secret.Answer
  2. B
    Deploy the Lambda function in the private subnet. Configure the Lambda function's security group to allow outbound traffic to 0.0.0.0/0 on all ports, and store the credentials in AWS Secrets Manager. Do not provision a NAT Gateway or VPC endpoints, relying on the Lambda service to natively route internet traffic.
  3. C
    Deploy the Lambda function in the private subnet. Create a NAT Gateway in a public subnet, and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway. Store the credentials in AWS Secrets Manager, and configure the Secrets Manager trust policy to allow the Lambda service to assume the database role.
  4. D
    Deploy the Lambda function in the private subnet. Create a NAT Gateway in a public subnet, and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway. Store the credentials as a plaintext parameter in Systems Manager Parameter Store, and grant the Lambda execution role permissions to retrieve the parameter.

Answer

Deploy the Lambda function in the private subnet, configure a NAT Gateway in a public subnet for external internet traffic, and secure credentials using AWS Secrets Manager with IAM execution role permissions.
The correct configuration deploys the Lambda function in the private subnet to connect locally to the private Aurora database. To access the external API, a NAT Gateway is deployed in a public subnet, and the private subnet's route table is updated to route internet-bound traffic (0.0.0.0/0) through it. Secrets Manager securely stores the database credentials, which the Lambda execution role can retrieve using standard identity-based permissions.

Step-by-Step Solution

1
Determine network access requirements for the Lambda function to reach the Aurora database and the external API.
The Lambda function must be placed in a VPC private subnet to access the private Aurora database. To reach the external API (public internet), it requires a NAT Gateway situated in a public subnet.
Lambda functions associated with a VPC private subnet do not have direct internet access unless outbound traffic is routed through a NAT Gateway or NAT instance.
2
Establish secure storage and access for database credentials.
Store the sensitive credentials in AWS Secrets Manager, and grant the Lambda execution role the necessary IAM permissions (secretsmanager:GetSecretValue) to retrieve them.
Storing credentials in Secrets Manager ensures encryption at rest and transit, supports rotation, and complies with security best practices.
3
Configure routing and security groups.
Add a route to the private subnet's route table directing 0.0.0.0/0 traffic to the NAT Gateway. Ensure the security groups allow outbound traffic from the Lambda function to the database and the NAT Gateway.
Proper route tables and security group rules are required to establish network paths to both local VPC resources and external services.

Key Concept

Configuring VPC routing and external API access for Lambda functions deployed inside private subnets, while securing credentials using AWS Secrets Manager.
Rate this question

Topics

VPC Security for Developers

More questions from this topic